TomatoCart 1.x versions include outdated and vulnerable Piwik extension < 0.5.5 according to the the Piwik SVN checkout date specified in /ext/piwik/index.php. This Piwik version has known vulnerabilities such as Cross Site Scripting, Arbitrary URL Redirect and Denial-of-Service.